Search Engine Vulnerabilities, Ghost Tokens, Anna Kournikova
Hacker And The Fed
00:00
Google's Ghost Token Attack
An attacker could get an application accepted. Probably changes its capabilities or exactly what the application does. Attackers would then immediately re-hide the application from the victim once it got access to a new access token. To maintain persistence, the attack loop must be executed periodically before the pending deletion project is purged.
Transcript
Play full episode
